tighten up logic; handle ie's appaling cors object